General
-
Target
704c421e2c761a7a218a4b2643164332ec67c4ec5a68201d4ece73d58bbbd8f4
-
Size
684KB
-
Sample
230328-lrh5asac42
-
MD5
c28d8e69c834e040f9034bf53aea52d9
-
SHA1
7f491c19413aa359f14a71ee977e8926b8b62cfc
-
SHA256
704c421e2c761a7a218a4b2643164332ec67c4ec5a68201d4ece73d58bbbd8f4
-
SHA512
84c25515f01d8f1fbc89c1ae28cf5ede6701a2fd786007d86c6a7382c5548e7663f64e01ceb9cb0116495b929a20c99a5e3988b0b32268d424e350d965421ad8
-
SSDEEP
12288:qMrKy90Qz3Yqq+ElfY1uO1HWlKMnyCigzavCpRyFNv/wzg:syFz3Yv+MvONCvyxyaaC
Static task
static1
Behavioral task
behavioral1
Sample
704c421e2c761a7a218a4b2643164332ec67c4ec5a68201d4ece73d58bbbd8f4.exe
Resource
win10-20230220-en
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
muse
176.113.115.145:4125
-
auth_value
b91988a63a24940038d9262827a5320c
Targets
-
-
Target
704c421e2c761a7a218a4b2643164332ec67c4ec5a68201d4ece73d58bbbd8f4
-
Size
684KB
-
MD5
c28d8e69c834e040f9034bf53aea52d9
-
SHA1
7f491c19413aa359f14a71ee977e8926b8b62cfc
-
SHA256
704c421e2c761a7a218a4b2643164332ec67c4ec5a68201d4ece73d58bbbd8f4
-
SHA512
84c25515f01d8f1fbc89c1ae28cf5ede6701a2fd786007d86c6a7382c5548e7663f64e01ceb9cb0116495b929a20c99a5e3988b0b32268d424e350d965421ad8
-
SSDEEP
12288:qMrKy90Qz3Yqq+ElfY1uO1HWlKMnyCigzavCpRyFNv/wzg:syFz3Yv+MvONCvyxyaaC
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-